The Assurance DeskGuides
Plain answers to common questions about data protection, AI governance and cyber security.
Data protection
UK GDPR’s seven principles, in plain English
Turn the rules into everyday checks on the information your organisation uses.
In this series
Does GDPR apply to small businesses and sole traders?
Start with the personal data you hold, then check your duties, fee and need for a DPO separately.
Who is a data controller, and who is a processor?
Follow the decisions about the data, rather than the label on the contract.
In this series
Is UK GDPR changing in 2026?
The law has changed, but your old data protection duties have not disappeared.
In this series
Do you have to pay the ICO fee?
Check the exemption first, then the right fee band, before paying a letter or invoice.
Do you need a data protection officer? UK GDPR sets three tests
Ask this before you hire anyone, because the answer changes what you need to buy.
In this series
How much does an outsourced DPO cost, and what does it cover?
The lowest monthly fee we found published for an outsourced DPO is £350 plus VAT, for two hours a month.
In this series
How do I choose a data protection or AI governance adviser?
Your organisation stays responsible for complying with UK GDPR whoever you hire, so it helps to know exactly what an adviser will do.
In this series
A data breach has happened: who do you call?
Get the right people involved, contain the breach and keep the reporting decisions clear.
In this series
ICO has written to you: what to do in the first week
Most letters from the regulator have a clear next step, and a calm first week makes the rest easier.
How much can the ICO fine you under UK GDPR?
The legal maximum is a ceiling, not a prediction of what a business will pay.
AI governance
What is AI governance, in plain words?
Give people a clear way to choose, use and check AI at work.
In this series
Does your UK business need an AI policy, and what goes in it?
If staff use AI tools at work, a policy is how your business decides what goes into them.
In this series
Do you need AI governance software, or is an adviser enough?
Knowing what each one does helps you buy the help you need, and only that.
In this series
Is there a qualification or certification for AI governance?
A qualification for a person and a certificate for an organisation answer different questions.
How does the UK regulate AI?
AI is covered by laws your firm may already follow, and the UK rules on automated decisions changed in 2026.
What does the EU AI Act ask of a UK business?
Some of its rules already apply, and your role decides which ones reach your firm.
In this series
ISO 42001 in the UK: who certifies you, and what does it cost?
A certificate is worth what the body behind it is accredited to do, so check the body before you choose.
In this series How do I choose a data protection or AI governance adviser?
Your organisation stays responsible for complying with UK GDPR whoever you hire, so it helps to know exactly what an adviser will do.
In this seriesCyber security
How much is Cyber Essentials, and what does it ask?
Know what the fee buys before you book an assessment or pay for help.
In this series
What does ISO 27001 certification take, and who can certify you?
Knowing the steps, and who may do each one, helps you plan the time and choose the right firms.
In this series
Customer security questionnaires: what they ask and how to answer
A clear response connects each answer to the service, the evidence and any work still to do.
In this series
SOC 2: what is it, and who asks for it?
A customer wants your SOC 2 report, so start by checking what they need it to show.
Incident response plan: what to write down
Give your team a plan they can find, read and use when something goes wrong.
In this series